@locker/shared-dom - npm Package Compare versions

Comparing version 0.22.3 to 0.22.4

dist/index.cjs.d.ts

@@ -63,2 +63,5 @@ /// <reference types="cacheable-request" />
     isEqualDomString: (leftString: string, rightString: string) => boolean;
+    // There is no reason to ever allow any HTML or XML that contains all three of these substrings.
+    // eslint-disable-next-line class-methods-use-this
+    isInherentlyUnsecure: (input: string) => boolean;
     isSharedElement: (element: Element | HTMLElement | Node) => boolean;
@@ -316,2 +319,13 @@ constructor(document: Document, { HTMLLinkElement, HTMLScriptElement, HTMLStyleElement }: GlobalObject);
 declare function initWindowOpenChildWindow<T extends GlobalObject>(win: T, url: string | undefined): T;
+type ChildWindow = Window & typeof globalThis & GlobalObject;
+// This is only used by window.open() and document.open(x, y, z) distortions to
+// block access to unsafe properties of the child window that's returned by those
+// APIs. These properties must be otherwise available directly on the sandbox window,
+// or via iframe.contentWindow created within the sandbox.
+// To be effective, we mark the blocked thing with a symbol, so that can be detected by
+// the distortion, otherwise the distortion will replace whatever we define here with
+// whatever it provides.
+declare const CHILD_WINDOW_BLOCKED_PROPERTY_SYMBOL: symbol;
+declare function markForUnsafePropertyBlocking(childWindow: ChildWindow): ChildWindow;
+declare function throwIfMarkedAsUnsafeInChildWindow(virtualEnvironmentEvaluator: Function, name: string): void;
 declare function isWindow(value: any): boolean;
@@ -343,3 +357,3 @@ declare function normalizeWindowOpenArguments(args: Parameters<typeof window.open>): [
 declare const XhrProtoWithCredentialsSetter: import("@locker/shared").Setter;
-export { AbortControllerCtor, AbortControllerProto, AbortControllerProtoAbort, AbortControllerProtoSignalGetter, AttrProtoNameGetter, AttrProtoNamespaceURIGetter, AttrProtoOwnerElementGetter, AttrProtoValueGetter, AttrProtoValueSetter, normalizeNamespacedAttributeName, rootValidator, getValidator, BlobCtor, BlobProtoSlice, BlobProtoSizeGetter, BlobProtoTypeGetter, CUSTOM_ELEMENT_REGISTRY_ATTRIBUTE_NAME, IS_CHROMIUM_BROWSER, IS_OLD_CHROMIUM_BROWSER, IS_WEBKIT_BROWSER, rootDocument, DocumentProtoClose, DocumentProtoOpen, DocumentProtoCreateComment, DocumentProtoCreateElement, DocumentProtoCreateElementNS, DocumentProtoGetElementById, DocumentProtoBodyGetter, DocumentProtoCookieGetter, DocumentProtoCookieSetter, DocumentProtoDefaultViewGetter, DocumentProtoDocumentElementGetter, DocumentProtoHeadGetter, DocumentProtoImplementationGetter, DocumentFragmentProtoGetElementById, DOMExceptionCtor, DATA_CLONE_ERROR_CODE, DOMExceptionProtoCodeGetter, DOMImplementationProtoCreateDocument, DOMTokenListProtoValueGetter, ElementAriaAttributesToPropertyName, ElementProtoRemove, ElementProtoClosest, ElementProtoGetAttribute, ElementProtoGetAttributeNode, ElementProtoGetAttributeNodeNS, ElementProtoHasAttribute, ElementProtoQuerySelector, ElementProtoQuerySelectorAll, ElementProtoRemoveAttribute, ElementProtoRemoveAttributeNode, ElementProtoRemoveAttributeNS, ElementProtoSetAttribute, ElementProtoSetAttributeNS, ElementProtoToggleAttribute, ElementProtoInnerHTMLGetter, ElementProtoInnerHTMLSetter, ElementProtoNamespaceURIGetter, ElementProtoOuterHTMLGetter, ElementProtoTagNameGetter, EventCtor, ErrorEventCtor, EventProtoStopPropagation, EventProtoCurrentTargetGetter, EventTargetProtoAddEventListener, EventTargetProtoDispatchEvent, EventTargetProtoRemoveEventListener, HTMLAnchorElementProtoHostnameGetter, HTMLAnchorElementProtoHrefGetter, HTMLAnchorElementProtoHrefSetter, HTMLAnchorElementProtoPathnameGetter, HTMLAnchorElementProtoProtocolGetter, HTMLElementProto, HTMLElementProtoStyleGetter, HTMLElementGlobalAttributesToPropertyName, HTMLIFrameElementProtoContentWindowGetter, HTMLIFrameElementProtoSrcSetter, HTMLScriptElementCtor, HTMLScriptElementProto, HTMLScriptElementProtoSrcGetter, HTMLScriptElementProtoSrcSetter, HTMLTemplateElementProtoContentGetter, NAMESPACE_DEFAULT, NAMESPACE_SVG, NAMESPACE_XHTML, NAMESPACE_XLINK, NodeProtoAppendChild, NodeProtoCloneNode, NodeProtoIsEqualNode, NodeProtoChildNodesGetter, NodeProtoFirstChildGetter, NodeProtoIsConnectedGetter, NodeProtoLastChildGetter, NodeProtoNodeNameGetter, NodeProtoOwnerDocumentGetter, NodeProtoTextContentGetter, NodeProtoTextContentSetter, RangeProtoCreateContextualFragment, RequestProtoURLGetter, ResponseCtor, ResponseProtoOkGetter, ResponseProtoStatus, ResponseProtoStatusText, ResponseProtoText, SCRIPT_HOOK_SOURCE_TEXT, defineScriptAccessorProperty, defineScriptEvaluatorProperty, deleteOriginalScriptProperty, deleteResolvedScriptURL, deleteScriptEvaluatorProperty, getOriginalScriptProperty, getResolvedScriptURL, getScriptSrcEvaluatorHookURL, isScriptEvaluated, isScriptPropertyEvaluatorHookDefined, isScriptURLEvaluatorHookDefined, setOriginalScriptScriptProperty, setResolvedScriptURL, trackScriptAsEvaluated, Transpiler, UNIVERSAL_CONTEXT_NAMES, compileSourceText, generateContextAssignmentCodeFromContextNames, transformSourceText, StorageProtoKey, StorageProtoGetItem, StorageProtoRemoveItem, StorageProtoSetItem, SVGScriptElementProtoHrefGetter, SVGScriptElementProtoHrefSetter, AttributeNameToResolvedURLRegistry, CookieStore, GlobalObject, SandboxEvaluator, SandboxRecord, ScriptElement, ScriptEvaluatorPropertyCallback, URLCreateObjectURL, URLRevokeObjectURL, rootWindow, WindowClearInterval, WindowDecodeURIComponent, WindowEncodeURIComponent, WindowFetch, rootWindowLocation, WindowSetInterval, rootWindowTop, WindowQueueMicrotask, WindowDocumentGetter, WindowFrameElementGetter, WindowLengthGetter, WindowLocationGetter, initWindowOpenChildWindow, isWindow, normalizeWindowOpenArguments, XhrCtor, XhrProtoAbort, XhrProtoOpen, XhrProtoSend, XhrProtoResponseTextGetter, XhrProtoStatusGetter, XhrProtoWithCredentialsSetter };
+export { AbortControllerCtor, AbortControllerProto, AbortControllerProtoAbort, AbortControllerProtoSignalGetter, AttrProtoNameGetter, AttrProtoNamespaceURIGetter, AttrProtoOwnerElementGetter, AttrProtoValueGetter, AttrProtoValueSetter, normalizeNamespacedAttributeName, rootValidator, getValidator, BlobCtor, BlobProtoSlice, BlobProtoSizeGetter, BlobProtoTypeGetter, CUSTOM_ELEMENT_REGISTRY_ATTRIBUTE_NAME, IS_CHROMIUM_BROWSER, IS_OLD_CHROMIUM_BROWSER, IS_WEBKIT_BROWSER, rootDocument, DocumentProtoClose, DocumentProtoOpen, DocumentProtoCreateComment, DocumentProtoCreateElement, DocumentProtoCreateElementNS, DocumentProtoGetElementById, DocumentProtoBodyGetter, DocumentProtoCookieGetter, DocumentProtoCookieSetter, DocumentProtoDefaultViewGetter, DocumentProtoDocumentElementGetter, DocumentProtoHeadGetter, DocumentProtoImplementationGetter, DocumentFragmentProtoGetElementById, DOMExceptionCtor, DATA_CLONE_ERROR_CODE, DOMExceptionProtoCodeGetter, DOMImplementationProtoCreateDocument, DOMTokenListProtoValueGetter, ElementAriaAttributesToPropertyName, ElementProtoRemove, ElementProtoClosest, ElementProtoGetAttribute, ElementProtoGetAttributeNode, ElementProtoGetAttributeNodeNS, ElementProtoHasAttribute, ElementProtoQuerySelector, ElementProtoQuerySelectorAll, ElementProtoRemoveAttribute, ElementProtoRemoveAttributeNode, ElementProtoRemoveAttributeNS, ElementProtoSetAttribute, ElementProtoSetAttributeNS, ElementProtoToggleAttribute, ElementProtoInnerHTMLGetter, ElementProtoInnerHTMLSetter, ElementProtoNamespaceURIGetter, ElementProtoOuterHTMLGetter, ElementProtoTagNameGetter, EventCtor, ErrorEventCtor, EventProtoStopPropagation, EventProtoCurrentTargetGetter, EventTargetProtoAddEventListener, EventTargetProtoDispatchEvent, EventTargetProtoRemoveEventListener, HTMLAnchorElementProtoHostnameGetter, HTMLAnchorElementProtoHrefGetter, HTMLAnchorElementProtoHrefSetter, HTMLAnchorElementProtoPathnameGetter, HTMLAnchorElementProtoProtocolGetter, HTMLElementProto, HTMLElementProtoStyleGetter, HTMLElementGlobalAttributesToPropertyName, HTMLIFrameElementProtoContentWindowGetter, HTMLIFrameElementProtoSrcSetter, HTMLScriptElementCtor, HTMLScriptElementProto, HTMLScriptElementProtoSrcGetter, HTMLScriptElementProtoSrcSetter, HTMLTemplateElementProtoContentGetter, NAMESPACE_DEFAULT, NAMESPACE_SVG, NAMESPACE_XHTML, NAMESPACE_XLINK, NodeProtoAppendChild, NodeProtoCloneNode, NodeProtoIsEqualNode, NodeProtoChildNodesGetter, NodeProtoFirstChildGetter, NodeProtoIsConnectedGetter, NodeProtoLastChildGetter, NodeProtoNodeNameGetter, NodeProtoOwnerDocumentGetter, NodeProtoTextContentGetter, NodeProtoTextContentSetter, RangeProtoCreateContextualFragment, RequestProtoURLGetter, ResponseCtor, ResponseProtoOkGetter, ResponseProtoStatus, ResponseProtoStatusText, ResponseProtoText, SCRIPT_HOOK_SOURCE_TEXT, defineScriptAccessorProperty, defineScriptEvaluatorProperty, deleteOriginalScriptProperty, deleteResolvedScriptURL, deleteScriptEvaluatorProperty, getOriginalScriptProperty, getResolvedScriptURL, getScriptSrcEvaluatorHookURL, isScriptEvaluated, isScriptPropertyEvaluatorHookDefined, isScriptURLEvaluatorHookDefined, setOriginalScriptScriptProperty, setResolvedScriptURL, trackScriptAsEvaluated, Transpiler, UNIVERSAL_CONTEXT_NAMES, compileSourceText, generateContextAssignmentCodeFromContextNames, transformSourceText, StorageProtoKey, StorageProtoGetItem, StorageProtoRemoveItem, StorageProtoSetItem, SVGScriptElementProtoHrefGetter, SVGScriptElementProtoHrefSetter, AttributeNameToResolvedURLRegistry, CookieStore, GlobalObject, SandboxEvaluator, SandboxRecord, ScriptElement, ScriptEvaluatorPropertyCallback, URLCreateObjectURL, URLRevokeObjectURL, rootWindow, WindowClearInterval, WindowDecodeURIComponent, WindowEncodeURIComponent, WindowFetch, rootWindowLocation, WindowSetInterval, rootWindowTop, WindowQueueMicrotask, WindowDocumentGetter, WindowFrameElementGetter, WindowLengthGetter, WindowLocationGetter, initWindowOpenChildWindow, ChildWindow, CHILD_WINDOW_BLOCKED_PROPERTY_SYMBOL, markForUnsafePropertyBlocking, throwIfMarkedAsUnsafeInChildWindow, isWindow, normalizeWindowOpenArguments, XhrCtor, XhrProtoAbort, XhrProtoOpen, XhrProtoSend, XhrProtoResponseTextGetter, XhrProtoStatusGetter, XhrProtoWithCredentialsSetter };
 //# sourceMappingURL=index.cjs.d.ts.map

dist/index.cjs.js

@@ -227,2 +227,3 @@ /*!
       // directly.
+      // istanbul ignore else: current tests have no way of expressing a state that would cause this condition to evaluate false
       if (location$LWS.href !== url$LWS) {
@@ -242,2 +243,53 @@ // Opening and closing `doc` prevents the default browser
 }
+// This is only used by window.open() and document.open(x, y, z) distortions to
+// block access to unsafe properties of the child window that's returned by those
+// APIs. These properties must be otherwise available directly on the sandbox window,
+// or via iframe.contentWindow created within the sandbox.
+// To be effective, we mark the blocked thing with a symbol, so that can be detected by
+// the distortion, otherwise the distortion will replace whatever we define here with
+// whatever it provides.
+const CHILD_WINDOW_BLOCKED_PROPERTY_SYMBOL$LWS = shared$LWS.SymbolFor('@@lwsChildWindowBlockedProperty');
+const CHILD_WINDOW_BLOCKED_PROPERTIES$LWS = ['eval', 'Function', 'setInterval', 'setTimeout'];
+function markForUnsafePropertyBlocking$LWS(childWindow$LWS) {
+  // If this function somehow receives the rootWindow, just return it.
+  if (!childWindow$LWS || childWindow$LWS === rootWindow$LWS) {
+    return childWindow$LWS;
+  }
+  for (const blocked$LWS of CHILD_WINDOW_BLOCKED_PROPERTIES$LWS) {
+    const descriptor$LWS = shared$LWS.ReflectGetOwnPropertyDescriptor(childWindow$LWS, blocked$LWS);
+    const replacement$LWS = /* istanbul ignore next: this replacement function will never actually be called */() => {};
+    shared$LWS.ReflectDefineProperty(replacement$LWS, CHILD_WINDOW_BLOCKED_PROPERTY_SYMBOL$LWS, {
+      __proto__: null,
+      configurable: false,
+      enumerable: false,
+      get() {
+        return true;
+      }
+    });
+    if (typeof childWindow$LWS[blocked$LWS] === 'function') {
+      descriptor$LWS.value = replacement$LWS;
+    }
+    /* Eventually there will be other types of blocked properties
+    else {
+        descriptor.get = replacement;
+    }
+    */
+    shared$LWS.ReflectDefineProperty(childWindow$LWS, blocked$LWS, descriptor$LWS);
+  }
+  return childWindow$LWS;
+}
+function throwIfMarkedAsUnsafeInChildWindow$LWS(virtualEnvironmentEvaluator$LWS, name$LWS) {
+  // This seemingly strange approach is necessary because this distortion will
+  // otherwise replace whatever was force-assigned to the childWindow property
+  // by markForUnsafePropertyBlocking with this distortion, effectively acting
+  // as an UNDO of markForUnsafePropertyBlocking(). We have to dig into
+  // the sandbox's global object and look at the actual property to see if it was
+  // marked for unsafe property blocking, because indirect property (ie. eval) will bypass
+  // any "this" property lookups.
+  const getPossiblyBlockedPropertyFromSandbox$LWS = virtualEnvironmentEvaluator$LWS(`() => globalThis.${name$LWS}`);
+  // istanbul ignore else: it is unnecessary to cover the else path here
+  if (getPossiblyBlockedPropertyFromSandbox$LWS()[CHILD_WINDOW_BLOCKED_PROPERTY_SYMBOL$LWS]) {
+    throw new shared$LWS.LockerSecurityError(`Cannot call ${name$LWS} on this window.`);
+  }
+}
 function isWindow$LWS(value$LWS) {
@@ -320,2 +372,5 @@ if (typeof value$LWS === 'object' && value$LWS !== null && shared$LWS.ObjectHasOwn(value$LWS, 'window') && value$LWS.window === value$LWS) {
     };
+    // There is no reason to ever allow any HTML or XML that contains all three of these substrings.
+    // eslint-disable-next-line class-methods-use-this
+    this.isInherentlyUnsecure = input$LWS => shared$LWS.ReflectApply(shared$LWS.StringProtoIncludes, input$LWS, ['iframe']) && shared$LWS.ReflectApply(shared$LWS.StringProtoIncludes, input$LWS, ['script']) && shared$LWS.ReflectApply(shared$LWS.StringProtoIncludes, input$LWS, ['srcdoc']);
     this.isSharedElement = element$LWS => element$LWS === shared$LWS.ReflectApply(DocumentProtoHeadGetter$LWS, this._document, []) || element$LWS === shared$LWS.ReflectApply(DocumentProtoBodyGetter$LWS, this._document, []) || element$LWS === shared$LWS.ReflectApply(DocumentProtoDocumentElementGetter$LWS, this._document, []);
@@ -1017,2 +1072,3 @@ this._constructors = {
 exports.BlobProtoTypeGetter = BlobProtoTypeGetter$LWS;
+exports.CHILD_WINDOW_BLOCKED_PROPERTY_SYMBOL = CHILD_WINDOW_BLOCKED_PROPERTY_SYMBOL$LWS;
 exports.CUSTOM_ELEMENT_REGISTRY_ATTRIBUTE_NAME = CUSTOM_ELEMENT_REGISTRY_ATTRIBUTE_NAME$LWS;
@@ -1149,2 +1205,3 @@ exports.DATA_CLONE_ERROR_CODE = DATA_CLONE_ERROR_CODE$LWS;
 exports.isWindow = isWindow$LWS;
+exports.markForUnsafePropertyBlocking = markForUnsafePropertyBlocking$LWS;
 exports.normalizeNamespacedAttributeName = normalizeNamespacedAttributeName$LWS;
@@ -1159,4 +1216,5 @@ exports.normalizeWindowOpenArguments = normalizeWindowOpenArguments$LWS;
 exports.setResolvedScriptURL = setResolvedScriptURL$LWS;
+exports.throwIfMarkedAsUnsafeInChildWindow = throwIfMarkedAsUnsafeInChildWindow$LWS;
 exports.trackScriptAsEvaluated = trackScriptAsEvaluated$LWS;
 exports.transformSourceText = transformSourceText$LWS;
-/*! version: 0.22.3 */
+/*! version: 0.22.4 */

dist/index.mjs.d.ts

@@ -63,2 +63,5 @@ /// <reference types="cacheable-request" />
     isEqualDomString: (leftString: string, rightString: string) => boolean;
+    // There is no reason to ever allow any HTML or XML that contains all three of these substrings.
+    // eslint-disable-next-line class-methods-use-this
+    isInherentlyUnsecure: (input: string) => boolean;
     isSharedElement: (element: Element | HTMLElement | Node) => boolean;
@@ -316,2 +319,13 @@ constructor(document: Document, { HTMLLinkElement, HTMLScriptElement, HTMLStyleElement }: GlobalObject);
 declare function initWindowOpenChildWindow<T extends GlobalObject>(win: T, url: string | undefined): T;
+type ChildWindow = Window & typeof globalThis & GlobalObject;
+// This is only used by window.open() and document.open(x, y, z) distortions to
+// block access to unsafe properties of the child window that's returned by those
+// APIs. These properties must be otherwise available directly on the sandbox window,
+// or via iframe.contentWindow created within the sandbox.
+// To be effective, we mark the blocked thing with a symbol, so that can be detected by
+// the distortion, otherwise the distortion will replace whatever we define here with
+// whatever it provides.
+declare const CHILD_WINDOW_BLOCKED_PROPERTY_SYMBOL: symbol;
+declare function markForUnsafePropertyBlocking(childWindow: ChildWindow): ChildWindow;
+declare function throwIfMarkedAsUnsafeInChildWindow(virtualEnvironmentEvaluator: Function, name: string): void;
 declare function isWindow(value: any): boolean;
@@ -343,3 +357,3 @@ declare function normalizeWindowOpenArguments(args: Parameters<typeof window.open>): [
 declare const XhrProtoWithCredentialsSetter: import("@locker/shared").Setter;
-export { AbortControllerCtor, AbortControllerProto, AbortControllerProtoAbort, AbortControllerProtoSignalGetter, AttrProtoNameGetter, AttrProtoNamespaceURIGetter, AttrProtoOwnerElementGetter, AttrProtoValueGetter, AttrProtoValueSetter, normalizeNamespacedAttributeName, rootValidator, getValidator, BlobCtor, BlobProtoSlice, BlobProtoSizeGetter, BlobProtoTypeGetter, CUSTOM_ELEMENT_REGISTRY_ATTRIBUTE_NAME, IS_CHROMIUM_BROWSER, IS_OLD_CHROMIUM_BROWSER, IS_WEBKIT_BROWSER, rootDocument, DocumentProtoClose, DocumentProtoOpen, DocumentProtoCreateComment, DocumentProtoCreateElement, DocumentProtoCreateElementNS, DocumentProtoGetElementById, DocumentProtoBodyGetter, DocumentProtoCookieGetter, DocumentProtoCookieSetter, DocumentProtoDefaultViewGetter, DocumentProtoDocumentElementGetter, DocumentProtoHeadGetter, DocumentProtoImplementationGetter, DocumentFragmentProtoGetElementById, DOMExceptionCtor, DATA_CLONE_ERROR_CODE, DOMExceptionProtoCodeGetter, DOMImplementationProtoCreateDocument, DOMTokenListProtoValueGetter, ElementAriaAttributesToPropertyName, ElementProtoRemove, ElementProtoClosest, ElementProtoGetAttribute, ElementProtoGetAttributeNode, ElementProtoGetAttributeNodeNS, ElementProtoHasAttribute, ElementProtoQuerySelector, ElementProtoQuerySelectorAll, ElementProtoRemoveAttribute, ElementProtoRemoveAttributeNode, ElementProtoRemoveAttributeNS, ElementProtoSetAttribute, ElementProtoSetAttributeNS, ElementProtoToggleAttribute, ElementProtoInnerHTMLGetter, ElementProtoInnerHTMLSetter, ElementProtoNamespaceURIGetter, ElementProtoOuterHTMLGetter, ElementProtoTagNameGetter, EventCtor, ErrorEventCtor, EventProtoStopPropagation, EventProtoCurrentTargetGetter, EventTargetProtoAddEventListener, EventTargetProtoDispatchEvent, EventTargetProtoRemoveEventListener, HTMLAnchorElementProtoHostnameGetter, HTMLAnchorElementProtoHrefGetter, HTMLAnchorElementProtoHrefSetter, HTMLAnchorElementProtoPathnameGetter, HTMLAnchorElementProtoProtocolGetter, HTMLElementProto, HTMLElementProtoStyleGetter, HTMLElementGlobalAttributesToPropertyName, HTMLIFrameElementProtoContentWindowGetter, HTMLIFrameElementProtoSrcSetter, HTMLScriptElementCtor, HTMLScriptElementProto, HTMLScriptElementProtoSrcGetter, HTMLScriptElementProtoSrcSetter, HTMLTemplateElementProtoContentGetter, NAMESPACE_DEFAULT, NAMESPACE_SVG, NAMESPACE_XHTML, NAMESPACE_XLINK, NodeProtoAppendChild, NodeProtoCloneNode, NodeProtoIsEqualNode, NodeProtoChildNodesGetter, NodeProtoFirstChildGetter, NodeProtoIsConnectedGetter, NodeProtoLastChildGetter, NodeProtoNodeNameGetter, NodeProtoOwnerDocumentGetter, NodeProtoTextContentGetter, NodeProtoTextContentSetter, RangeProtoCreateContextualFragment, RequestProtoURLGetter, ResponseCtor, ResponseProtoOkGetter, ResponseProtoStatus, ResponseProtoStatusText, ResponseProtoText, SCRIPT_HOOK_SOURCE_TEXT, defineScriptAccessorProperty, defineScriptEvaluatorProperty, deleteOriginalScriptProperty, deleteResolvedScriptURL, deleteScriptEvaluatorProperty, getOriginalScriptProperty, getResolvedScriptURL, getScriptSrcEvaluatorHookURL, isScriptEvaluated, isScriptPropertyEvaluatorHookDefined, isScriptURLEvaluatorHookDefined, setOriginalScriptScriptProperty, setResolvedScriptURL, trackScriptAsEvaluated, Transpiler, UNIVERSAL_CONTEXT_NAMES, compileSourceText, generateContextAssignmentCodeFromContextNames, transformSourceText, StorageProtoKey, StorageProtoGetItem, StorageProtoRemoveItem, StorageProtoSetItem, SVGScriptElementProtoHrefGetter, SVGScriptElementProtoHrefSetter, AttributeNameToResolvedURLRegistry, CookieStore, GlobalObject, SandboxEvaluator, SandboxRecord, ScriptElement, ScriptEvaluatorPropertyCallback, URLCreateObjectURL, URLRevokeObjectURL, rootWindow, WindowClearInterval, WindowDecodeURIComponent, WindowEncodeURIComponent, WindowFetch, rootWindowLocation, WindowSetInterval, rootWindowTop, WindowQueueMicrotask, WindowDocumentGetter, WindowFrameElementGetter, WindowLengthGetter, WindowLocationGetter, initWindowOpenChildWindow, isWindow, normalizeWindowOpenArguments, XhrCtor, XhrProtoAbort, XhrProtoOpen, XhrProtoSend, XhrProtoResponseTextGetter, XhrProtoStatusGetter, XhrProtoWithCredentialsSetter };
+export { AbortControllerCtor, AbortControllerProto, AbortControllerProtoAbort, AbortControllerProtoSignalGetter, AttrProtoNameGetter, AttrProtoNamespaceURIGetter, AttrProtoOwnerElementGetter, AttrProtoValueGetter, AttrProtoValueSetter, normalizeNamespacedAttributeName, rootValidator, getValidator, BlobCtor, BlobProtoSlice, BlobProtoSizeGetter, BlobProtoTypeGetter, CUSTOM_ELEMENT_REGISTRY_ATTRIBUTE_NAME, IS_CHROMIUM_BROWSER, IS_OLD_CHROMIUM_BROWSER, IS_WEBKIT_BROWSER, rootDocument, DocumentProtoClose, DocumentProtoOpen, DocumentProtoCreateComment, DocumentProtoCreateElement, DocumentProtoCreateElementNS, DocumentProtoGetElementById, DocumentProtoBodyGetter, DocumentProtoCookieGetter, DocumentProtoCookieSetter, DocumentProtoDefaultViewGetter, DocumentProtoDocumentElementGetter, DocumentProtoHeadGetter, DocumentProtoImplementationGetter, DocumentFragmentProtoGetElementById, DOMExceptionCtor, DATA_CLONE_ERROR_CODE, DOMExceptionProtoCodeGetter, DOMImplementationProtoCreateDocument, DOMTokenListProtoValueGetter, ElementAriaAttributesToPropertyName, ElementProtoRemove, ElementProtoClosest, ElementProtoGetAttribute, ElementProtoGetAttributeNode, ElementProtoGetAttributeNodeNS, ElementProtoHasAttribute, ElementProtoQuerySelector, ElementProtoQuerySelectorAll, ElementProtoRemoveAttribute, ElementProtoRemoveAttributeNode, ElementProtoRemoveAttributeNS, ElementProtoSetAttribute, ElementProtoSetAttributeNS, ElementProtoToggleAttribute, ElementProtoInnerHTMLGetter, ElementProtoInnerHTMLSetter, ElementProtoNamespaceURIGetter, ElementProtoOuterHTMLGetter, ElementProtoTagNameGetter, EventCtor, ErrorEventCtor, EventProtoStopPropagation, EventProtoCurrentTargetGetter, EventTargetProtoAddEventListener, EventTargetProtoDispatchEvent, EventTargetProtoRemoveEventListener, HTMLAnchorElementProtoHostnameGetter, HTMLAnchorElementProtoHrefGetter, HTMLAnchorElementProtoHrefSetter, HTMLAnchorElementProtoPathnameGetter, HTMLAnchorElementProtoProtocolGetter, HTMLElementProto, HTMLElementProtoStyleGetter, HTMLElementGlobalAttributesToPropertyName, HTMLIFrameElementProtoContentWindowGetter, HTMLIFrameElementProtoSrcSetter, HTMLScriptElementCtor, HTMLScriptElementProto, HTMLScriptElementProtoSrcGetter, HTMLScriptElementProtoSrcSetter, HTMLTemplateElementProtoContentGetter, NAMESPACE_DEFAULT, NAMESPACE_SVG, NAMESPACE_XHTML, NAMESPACE_XLINK, NodeProtoAppendChild, NodeProtoCloneNode, NodeProtoIsEqualNode, NodeProtoChildNodesGetter, NodeProtoFirstChildGetter, NodeProtoIsConnectedGetter, NodeProtoLastChildGetter, NodeProtoNodeNameGetter, NodeProtoOwnerDocumentGetter, NodeProtoTextContentGetter, NodeProtoTextContentSetter, RangeProtoCreateContextualFragment, RequestProtoURLGetter, ResponseCtor, ResponseProtoOkGetter, ResponseProtoStatus, ResponseProtoStatusText, ResponseProtoText, SCRIPT_HOOK_SOURCE_TEXT, defineScriptAccessorProperty, defineScriptEvaluatorProperty, deleteOriginalScriptProperty, deleteResolvedScriptURL, deleteScriptEvaluatorProperty, getOriginalScriptProperty, getResolvedScriptURL, getScriptSrcEvaluatorHookURL, isScriptEvaluated, isScriptPropertyEvaluatorHookDefined, isScriptURLEvaluatorHookDefined, setOriginalScriptScriptProperty, setResolvedScriptURL, trackScriptAsEvaluated, Transpiler, UNIVERSAL_CONTEXT_NAMES, compileSourceText, generateContextAssignmentCodeFromContextNames, transformSourceText, StorageProtoKey, StorageProtoGetItem, StorageProtoRemoveItem, StorageProtoSetItem, SVGScriptElementProtoHrefGetter, SVGScriptElementProtoHrefSetter, AttributeNameToResolvedURLRegistry, CookieStore, GlobalObject, SandboxEvaluator, SandboxRecord, ScriptElement, ScriptEvaluatorPropertyCallback, URLCreateObjectURL, URLRevokeObjectURL, rootWindow, WindowClearInterval, WindowDecodeURIComponent, WindowEncodeURIComponent, WindowFetch, rootWindowLocation, WindowSetInterval, rootWindowTop, WindowQueueMicrotask, WindowDocumentGetter, WindowFrameElementGetter, WindowLengthGetter, WindowLocationGetter, initWindowOpenChildWindow, ChildWindow, CHILD_WINDOW_BLOCKED_PROPERTY_SYMBOL, markForUnsafePropertyBlocking, throwIfMarkedAsUnsafeInChildWindow, isWindow, normalizeWindowOpenArguments, XhrCtor, XhrProtoAbort, XhrProtoOpen, XhrProtoSend, XhrProtoResponseTextGetter, XhrProtoStatusGetter, XhrProtoWithCredentialsSetter };
 //# sourceMappingURL=index.mjs.d.ts.map

dist/index.mjs.js

 /*!
  * Copyright (C) 2019 salesforce.com, inc.
  */
-import { ObjectLookupOwnGetter as ObjectLookupOwnGetter$LWS, ReflectGetOwnPropertyDescriptor as ReflectGetOwnPropertyDescriptor$LWS, ReflectApply as ReflectApply$LWS, StringProtoEndsWith as StringProtoEndsWith$LWS, StringProtoStartsWith as StringProtoStartsWith$LWS, PromiseResolve as PromiseResolve$LWS, PromiseProtoThen as PromiseProtoThen$LWS, PromiseProtoCatch as PromiseProtoCatch$LWS, ObjectHasOwn as ObjectHasOwn$LWS, shallowCloneArray as shallowCloneArray$LWS, StringProtoToLowerCase as StringProtoToLowerCase$LWS, RegExpProtoTest as RegExpProtoTest$LWS, StringProtoReplace as StringProtoReplace$LWS, toSafeWeakMap as toSafeWeakMap$LWS, WeakMapCtor as WeakMapCtor$LWS, ArrayIsArray as ArrayIsArray$LWS, ArrayProtoFind as ArrayProtoFind$LWS, LOCKER_SERVICE_KEY_LOWERED as LOCKER_SERVICE_KEY_LOWERED$LWS, getUnmaskedFunction as getUnmaskedFunction$LWS, ObjectLookupOwnSetter as ObjectLookupOwnSetter$LWS, toSafeWeakSet as toSafeWeakSet$LWS, WeakSetCtor as WeakSetCtor$LWS, ReflectDefineProperty as ReflectDefineProperty$LWS, FunctionProtoBind as FunctionProtoBind$LWS, UNCOMPILED_LOCATION_NAME as UNCOMPILED_LOCATION_NAME$LWS, UNCOMPILED_TOP_NAME as UNCOMPILED_TOP_NAME$LWS, LockerSecurityError as LockerSecurityError$LWS, ReflectDeleteProperty as ReflectDeleteProperty$LWS, StringProtoCharCodeAt as StringProtoCharCodeAt$LWS, ArrayProtoJoin as ArrayProtoJoin$LWS, RegExpCtor as RegExpCtor$LWS, RegExpProtoExec as RegExpProtoExec$LWS, StringProtoSubstring as StringProtoSubstring$LWS, StringProtoSlice as StringProtoSlice$LWS, toRegExpEscapedString as toRegExpEscapedString$LWS, SANDBOX_EVAL_CONTEXT_NAME as SANDBOX_EVAL_CONTEXT_NAME$LWS, toRegExpEscapedIdentifierName as toRegExpEscapedIdentifierName$LWS, WEBPACK_REQUIRE_NAME as WEBPACK_REQUIRE_NAME$LWS, ArrayProtoToString as ArrayProtoToString$LWS, indexOfPragma as indexOfPragma$LWS } from '@locker/shared';
+import { ObjectLookupOwnGetter as ObjectLookupOwnGetter$LWS, ReflectGetOwnPropertyDescriptor as ReflectGetOwnPropertyDescriptor$LWS, ReflectApply as ReflectApply$LWS, StringProtoEndsWith as StringProtoEndsWith$LWS, StringProtoStartsWith as StringProtoStartsWith$LWS, SymbolFor as SymbolFor$LWS, PromiseResolve as PromiseResolve$LWS, PromiseProtoThen as PromiseProtoThen$LWS, PromiseProtoCatch as PromiseProtoCatch$LWS, ReflectDefineProperty as ReflectDefineProperty$LWS, LockerSecurityError as LockerSecurityError$LWS, ObjectHasOwn as ObjectHasOwn$LWS, shallowCloneArray as shallowCloneArray$LWS, StringProtoToLowerCase as StringProtoToLowerCase$LWS, RegExpProtoTest as RegExpProtoTest$LWS, StringProtoReplace as StringProtoReplace$LWS, toSafeWeakMap as toSafeWeakMap$LWS, WeakMapCtor as WeakMapCtor$LWS, StringProtoIncludes as StringProtoIncludes$LWS, ArrayIsArray as ArrayIsArray$LWS, ArrayProtoFind as ArrayProtoFind$LWS, LOCKER_SERVICE_KEY_LOWERED as LOCKER_SERVICE_KEY_LOWERED$LWS, getUnmaskedFunction as getUnmaskedFunction$LWS, ObjectLookupOwnSetter as ObjectLookupOwnSetter$LWS, toSafeWeakSet as toSafeWeakSet$LWS, WeakSetCtor as WeakSetCtor$LWS, FunctionProtoBind as FunctionProtoBind$LWS, UNCOMPILED_LOCATION_NAME as UNCOMPILED_LOCATION_NAME$LWS, UNCOMPILED_TOP_NAME as UNCOMPILED_TOP_NAME$LWS, ReflectDeleteProperty as ReflectDeleteProperty$LWS, StringProtoCharCodeAt as StringProtoCharCodeAt$LWS, ArrayProtoJoin as ArrayProtoJoin$LWS, RegExpCtor as RegExpCtor$LWS, RegExpProtoExec as RegExpProtoExec$LWS, StringProtoSubstring as StringProtoSubstring$LWS, StringProtoSlice as StringProtoSlice$LWS, toRegExpEscapedString as toRegExpEscapedString$LWS, SANDBOX_EVAL_CONTEXT_NAME as SANDBOX_EVAL_CONTEXT_NAME$LWS, toRegExpEscapedIdentifierName as toRegExpEscapedIdentifierName$LWS, WEBPACK_REQUIRE_NAME as WEBPACK_REQUIRE_NAME$LWS, ArrayProtoToString as ArrayProtoToString$LWS, indexOfPragma as indexOfPragma$LWS } from '@locker/shared';
 const AbortControllerCtor$LWS = AbortController;
@@ -222,2 +222,3 @@ const {
       // directly.
+      // istanbul ignore else: current tests have no way of expressing a state that would cause this condition to evaluate false
       if (location$LWS.href !== url$LWS) {
@@ -237,2 +238,53 @@ // Opening and closing `doc` prevents the default browser
 }
+// This is only used by window.open() and document.open(x, y, z) distortions to
+// block access to unsafe properties of the child window that's returned by those
+// APIs. These properties must be otherwise available directly on the sandbox window,
+// or via iframe.contentWindow created within the sandbox.
+// To be effective, we mark the blocked thing with a symbol, so that can be detected by
+// the distortion, otherwise the distortion will replace whatever we define here with
+// whatever it provides.
+const CHILD_WINDOW_BLOCKED_PROPERTY_SYMBOL$LWS = SymbolFor$LWS('@@lwsChildWindowBlockedProperty');
+const CHILD_WINDOW_BLOCKED_PROPERTIES$LWS = ['eval', 'Function', 'setInterval', 'setTimeout'];
+function markForUnsafePropertyBlocking$LWS(childWindow$LWS) {
+  // If this function somehow receives the rootWindow, just return it.
+  if (!childWindow$LWS || childWindow$LWS === rootWindow$LWS) {
+    return childWindow$LWS;
+  }
+  for (const blocked$LWS of CHILD_WINDOW_BLOCKED_PROPERTIES$LWS) {
+    const descriptor$LWS = ReflectGetOwnPropertyDescriptor$LWS(childWindow$LWS, blocked$LWS);
+    const replacement$LWS = /* istanbul ignore next: this replacement function will never actually be called */() => {};
+    ReflectDefineProperty$LWS(replacement$LWS, CHILD_WINDOW_BLOCKED_PROPERTY_SYMBOL$LWS, {
+      __proto__: null,
+      configurable: false,
+      enumerable: false,
+      get() {
+        return true;
+      }
+    });
+    if (typeof childWindow$LWS[blocked$LWS] === 'function') {
+      descriptor$LWS.value = replacement$LWS;
+    }
+    /* Eventually there will be other types of blocked properties
+    else {
+        descriptor.get = replacement;
+    }
+    */
+    ReflectDefineProperty$LWS(childWindow$LWS, blocked$LWS, descriptor$LWS);
+  }
+  return childWindow$LWS;
+}
+function throwIfMarkedAsUnsafeInChildWindow$LWS(virtualEnvironmentEvaluator$LWS, name$LWS) {
+  // This seemingly strange approach is necessary because this distortion will
+  // otherwise replace whatever was force-assigned to the childWindow property
+  // by markForUnsafePropertyBlocking with this distortion, effectively acting
+  // as an UNDO of markForUnsafePropertyBlocking(). We have to dig into
+  // the sandbox's global object and look at the actual property to see if it was
+  // marked for unsafe property blocking, because indirect property (ie. eval) will bypass
+  // any "this" property lookups.
+  const getPossiblyBlockedPropertyFromSandbox$LWS = virtualEnvironmentEvaluator$LWS(`() => globalThis.${name$LWS}`);
+  // istanbul ignore else: it is unnecessary to cover the else path here
+  if (getPossiblyBlockedPropertyFromSandbox$LWS()[CHILD_WINDOW_BLOCKED_PROPERTY_SYMBOL$LWS]) {
+    throw new LockerSecurityError$LWS(`Cannot call ${name$LWS} on this window.`);
+  }
+}
 function isWindow$LWS(value$LWS) {
@@ -315,2 +367,5 @@ if (typeof value$LWS === 'object' && value$LWS !== null && ObjectHasOwn$LWS(value$LWS, 'window') && value$LWS.window === value$LWS) {
     };
+    // There is no reason to ever allow any HTML or XML that contains all three of these substrings.
+    // eslint-disable-next-line class-methods-use-this
+    this.isInherentlyUnsecure = input$LWS => ReflectApply$LWS(StringProtoIncludes$LWS, input$LWS, ['iframe']) && ReflectApply$LWS(StringProtoIncludes$LWS, input$LWS, ['script']) && ReflectApply$LWS(StringProtoIncludes$LWS, input$LWS, ['srcdoc']);
     this.isSharedElement = element$LWS => element$LWS === ReflectApply$LWS(DocumentProtoHeadGetter$LWS, this._document, []) || element$LWS === ReflectApply$LWS(DocumentProtoBodyGetter$LWS, this._document, []) || element$LWS === ReflectApply$LWS(DocumentProtoDocumentElementGetter$LWS, this._document, []);
@@ -999,3 +1054,3 @@ this._constructors = {
 const XhrProtoWithCredentialsSetter$LWS = ObjectLookupOwnSetter$LWS(XhrProto$LWS, 'withCredentials');
-export { AbortControllerCtor$LWS as AbortControllerCtor, AbortControllerProto$LWS as AbortControllerProto, AbortControllerProtoAbort$LWS as AbortControllerProtoAbort, AbortControllerProtoSignalGetter$LWS as AbortControllerProtoSignalGetter, AttrProtoNameGetter$LWS as AttrProtoNameGetter, AttrProtoNamespaceURIGetter$LWS as AttrProtoNamespaceURIGetter, AttrProtoOwnerElementGetter$LWS as AttrProtoOwnerElementGetter, AttrProtoValueGetter$LWS as AttrProtoValueGetter, AttrProtoValueSetter$LWS as AttrProtoValueSetter, BlobCtor$LWS as BlobCtor, BlobProtoSizeGetter$LWS as BlobProtoSizeGetter, BlobProtoSlice$LWS as BlobProtoSlice, BlobProtoTypeGetter$LWS as BlobProtoTypeGetter, CUSTOM_ELEMENT_REGISTRY_ATTRIBUTE_NAME$LWS as CUSTOM_ELEMENT_REGISTRY_ATTRIBUTE_NAME, DATA_CLONE_ERROR_CODE$LWS as DATA_CLONE_ERROR_CODE, DOMExceptionCtor$LWS as DOMExceptionCtor, DOMExceptionProtoCodeGetter$LWS as DOMExceptionProtoCodeGetter, DOMImplementationProtoCreateDocument$LWS as DOMImplementationProtoCreateDocument, DOMTokenListProtoValueGetter$LWS as DOMTokenListProtoValueGetter, DocumentFragmentProtoGetElementById$LWS as DocumentFragmentProtoGetElementById, DocumentProtoBodyGetter$LWS as DocumentProtoBodyGetter, DocumentProtoClose$LWS as DocumentProtoClose, DocumentProtoCookieGetter$LWS as DocumentProtoCookieGetter, DocumentProtoCookieSetter$LWS as DocumentProtoCookieSetter, DocumentProtoCreateComment$LWS as DocumentProtoCreateComment, DocumentProtoCreateElement$LWS as DocumentProtoCreateElement, DocumentProtoCreateElementNS$LWS as DocumentProtoCreateElementNS, DocumentProtoDefaultViewGetter$LWS as DocumentProtoDefaultViewGetter, DocumentProtoDocumentElementGetter$LWS as DocumentProtoDocumentElementGetter, DocumentProtoGetElementById$LWS as DocumentProtoGetElementById, DocumentProtoHeadGetter$LWS as DocumentProtoHeadGetter, DocumentProtoImplementationGetter$LWS as DocumentProtoImplementationGetter, DocumentProtoOpen$LWS as DocumentProtoOpen, ElementAriaAttributesToPropertyName$LWS as ElementAriaAttributesToPropertyName, ElementProtoClosest$LWS as ElementProtoClosest, ElementProtoGetAttribute$LWS as ElementProtoGetAttribute, ElementProtoGetAttributeNode$LWS as ElementProtoGetAttributeNode, ElementProtoGetAttributeNodeNS$LWS as ElementProtoGetAttributeNodeNS, ElementProtoHasAttribute$LWS as ElementProtoHasAttribute, ElementProtoInnerHTMLGetter$LWS as ElementProtoInnerHTMLGetter, ElementProtoInnerHTMLSetter$LWS as ElementProtoInnerHTMLSetter, ElementProtoNamespaceURIGetter$LWS as ElementProtoNamespaceURIGetter, ElementProtoOuterHTMLGetter$LWS as ElementProtoOuterHTMLGetter, ElementProtoQuerySelector$LWS as ElementProtoQuerySelector, ElementProtoQuerySelectorAll$LWS as ElementProtoQuerySelectorAll, ElementProtoRemove$LWS as ElementProtoRemove, ElementProtoRemoveAttribute$LWS as ElementProtoRemoveAttribute, ElementProtoRemoveAttributeNS$LWS as ElementProtoRemoveAttributeNS, ElementProtoRemoveAttributeNode$LWS as ElementProtoRemoveAttributeNode, ElementProtoSetAttribute$LWS as ElementProtoSetAttribute, ElementProtoSetAttributeNS$LWS as ElementProtoSetAttributeNS, ElementProtoTagNameGetter$LWS as ElementProtoTagNameGetter, ElementProtoToggleAttribute$LWS as ElementProtoToggleAttribute, ErrorEventCtor$LWS as ErrorEventCtor, EventCtor$LWS as EventCtor, EventProtoCurrentTargetGetter$LWS as EventProtoCurrentTargetGetter, EventProtoStopPropagation$LWS as EventProtoStopPropagation, EventTargetProtoAddEventListener$LWS as EventTargetProtoAddEventListener, EventTargetProtoDispatchEvent$LWS as EventTargetProtoDispatchEvent, EventTargetProtoRemoveEventListener$LWS as EventTargetProtoRemoveEventListener, HTMLAnchorElementProtoHostnameGetter$LWS as HTMLAnchorElementProtoHostnameGetter, HTMLAnchorElementProtoHrefGetter$LWS as HTMLAnchorElementProtoHrefGetter, HTMLAnchorElementProtoHrefSetter$LWS as HTMLAnchorElementProtoHrefSetter, HTMLAnchorElementProtoPathnameGetter$LWS as HTMLAnchorElementProtoPathnameGetter, HTMLAnchorElementProtoProtocolGetter$LWS as HTMLAnchorElementProtoProtocolGetter, HTMLElementGlobalAttributesToPropertyName$LWS as HTMLElementGlobalAttributesToPropertyName, HTMLElementProto$LWS as HTMLElementProto, HTMLElementProtoStyleGetter$LWS as HTMLElementProtoStyleGetter, HTMLIFrameElementProtoContentWindowGetter$LWS as HTMLIFrameElementProtoContentWindowGetter, HTMLIFrameElementProtoSrcSetter$LWS as HTMLIFrameElementProtoSrcSetter, HTMLScriptElementCtor$LWS as HTMLScriptElementCtor, HTMLScriptElementProto$LWS as HTMLScriptElementProto, HTMLScriptElementProtoSrcGetter$LWS as HTMLScriptElementProtoSrcGetter, HTMLScriptElementProtoSrcSetter$LWS as HTMLScriptElementProtoSrcSetter, HTMLTemplateElementProtoContentGetter$LWS as HTMLTemplateElementProtoContentGetter, IS_CHROMIUM_BROWSER$LWS as IS_CHROMIUM_BROWSER, IS_OLD_CHROMIUM_BROWSER$LWS as IS_OLD_CHROMIUM_BROWSER, IS_WEBKIT_BROWSER$LWS as IS_WEBKIT_BROWSER, NAMESPACE_DEFAULT$LWS as NAMESPACE_DEFAULT, NAMESPACE_SVG$LWS as NAMESPACE_SVG, NAMESPACE_XHTML$LWS as NAMESPACE_XHTML, NAMESPACE_XLINK$LWS as NAMESPACE_XLINK, NodeProtoAppendChild$LWS as NodeProtoAppendChild, NodeProtoChildNodesGetter$LWS as NodeProtoChildNodesGetter, NodeProtoCloneNode$LWS as NodeProtoCloneNode, NodeProtoFirstChildGetter$LWS as NodeProtoFirstChildGetter, NodeProtoIsConnectedGetter$LWS as NodeProtoIsConnectedGetter, NodeProtoIsEqualNode$LWS as NodeProtoIsEqualNode, NodeProtoLastChildGetter$LWS as NodeProtoLastChildGetter, NodeProtoNodeNameGetter$LWS as NodeProtoNodeNameGetter, NodeProtoOwnerDocumentGetter$LWS as NodeProtoOwnerDocumentGetter, NodeProtoTextContentGetter$LWS as NodeProtoTextContentGetter, NodeProtoTextContentSetter$LWS as NodeProtoTextContentSetter, RangeProtoCreateContextualFragment$LWS as RangeProtoCreateContextualFragment, RequestProtoURLGetter$LWS as RequestProtoURLGetter, ResponseCtor$LWS as ResponseCtor, ResponseProtoOkGetter$LWS as ResponseProtoOkGetter, ResponseProtoStatus$LWS as ResponseProtoStatus, ResponseProtoStatusText$LWS as ResponseProtoStatusText, ResponseProtoText$LWS as ResponseProtoText, SCRIPT_HOOK_SOURCE_TEXT$LWS as SCRIPT_HOOK_SOURCE_TEXT, SVGScriptElementProtoHrefGetter$LWS as SVGScriptElementProtoHrefGetter, SVGScriptElementProtoHrefSetter$LWS as SVGScriptElementProtoHrefSetter, StorageProtoGetItem$LWS as StorageProtoGetItem, StorageProtoKey$LWS as StorageProtoKey, StorageProtoRemoveItem$LWS as StorageProtoRemoveItem, StorageProtoSetItem$LWS as StorageProtoSetItem, Transpiler$LWS as Transpiler, UNIVERSAL_CONTEXT_NAMES$LWS as UNIVERSAL_CONTEXT_NAMES, URLCreateObjectURL$LWS as URLCreateObjectURL, URLRevokeObjectURL$LWS as URLRevokeObjectURL, WindowClearInterval$LWS as WindowClearInterval, WindowDecodeURIComponent$LWS as WindowDecodeURIComponent, WindowDocumentGetter$LWS as WindowDocumentGetter, WindowEncodeURIComponent$LWS as WindowEncodeURIComponent, WindowFetch$LWS as WindowFetch, WindowFrameElementGetter$LWS as WindowFrameElementGetter, WindowLengthGetter$LWS as WindowLengthGetter, WindowLocationGetter$LWS as WindowLocationGetter, WindowQueueMicrotask$LWS as WindowQueueMicrotask, WindowSetInterval$LWS as WindowSetInterval, XhrCtor$LWS as XhrCtor, XhrProtoAbort$LWS as XhrProtoAbort, XhrProtoOpen$LWS as XhrProtoOpen, XhrProtoResponseTextGetter$LWS as XhrProtoResponseTextGetter, XhrProtoSend$LWS as XhrProtoSend, XhrProtoStatusGetter$LWS as XhrProtoStatusGetter, XhrProtoWithCredentialsSetter$LWS as XhrProtoWithCredentialsSetter, compileSourceText$LWS as compileSourceText, defineScriptAccessorProperty$LWS as defineScriptAccessorProperty, defineScriptEvaluatorProperty$LWS as defineScriptEvaluatorProperty, deleteOriginalScriptProperty$LWS as deleteOriginalScriptProperty, deleteResolvedScriptURL$LWS as deleteResolvedScriptURL, deleteScriptEvaluatorProperty$LWS as deleteScriptEvaluatorProperty, generateContextAssignmentCodeFromContextNames$LWS as generateContextAssignmentCodeFromContextNames, getOriginalScriptProperty$LWS as getOriginalScriptProperty, getResolvedScriptURL$LWS as getResolvedScriptURL, getScriptSrcEvaluatorHookURL$LWS as getScriptSrcEvaluatorHookURL, getValidator$LWS as getValidator, initWindowOpenChildWindow$LWS as initWindowOpenChildWindow, isScriptEvaluated$LWS as isScriptEvaluated, isScriptPropertyEvaluatorHookDefined$LWS as isScriptPropertyEvaluatorHookDefined, isScriptURLEvaluatorHookDefined$LWS as isScriptURLEvaluatorHookDefined, isWindow$LWS as isWindow, normalizeNamespacedAttributeName$LWS as normalizeNamespacedAttributeName, normalizeWindowOpenArguments$LWS as normalizeWindowOpenArguments, rootDocument$LWS as rootDocument, rootValidator$LWS as rootValidator, rootWindow$LWS as rootWindow, rootWindowLocation$LWS as rootWindowLocation, rootWindowTop$LWS as rootWindowTop, setOriginalScriptScriptProperty$LWS as setOriginalScriptScriptProperty, setResolvedScriptURL$LWS as setResolvedScriptURL, trackScriptAsEvaluated$LWS as trackScriptAsEvaluated, transformSourceText$LWS as transformSourceText };
-/*! version: 0.22.3 */
+export { AbortControllerCtor$LWS as AbortControllerCtor, AbortControllerProto$LWS as AbortControllerProto, AbortControllerProtoAbort$LWS as AbortControllerProtoAbort, AbortControllerProtoSignalGetter$LWS as AbortControllerProtoSignalGetter, AttrProtoNameGetter$LWS as AttrProtoNameGetter, AttrProtoNamespaceURIGetter$LWS as AttrProtoNamespaceURIGetter, AttrProtoOwnerElementGetter$LWS as AttrProtoOwnerElementGetter, AttrProtoValueGetter$LWS as AttrProtoValueGetter, AttrProtoValueSetter$LWS as AttrProtoValueSetter, BlobCtor$LWS as BlobCtor, BlobProtoSizeGetter$LWS as BlobProtoSizeGetter, BlobProtoSlice$LWS as BlobProtoSlice, BlobProtoTypeGetter$LWS as BlobProtoTypeGetter, CHILD_WINDOW_BLOCKED_PROPERTY_SYMBOL$LWS as CHILD_WINDOW_BLOCKED_PROPERTY_SYMBOL, CUSTOM_ELEMENT_REGISTRY_ATTRIBUTE_NAME$LWS as CUSTOM_ELEMENT_REGISTRY_ATTRIBUTE_NAME, DATA_CLONE_ERROR_CODE$LWS as DATA_CLONE_ERROR_CODE, DOMExceptionCtor$LWS as DOMExceptionCtor, DOMExceptionProtoCodeGetter$LWS as DOMExceptionProtoCodeGetter, DOMImplementationProtoCreateDocument$LWS as DOMImplementationProtoCreateDocument, DOMTokenListProtoValueGetter$LWS as DOMTokenListProtoValueGetter, DocumentFragmentProtoGetElementById$LWS as DocumentFragmentProtoGetElementById, DocumentProtoBodyGetter$LWS as DocumentProtoBodyGetter, DocumentProtoClose$LWS as DocumentProtoClose, DocumentProtoCookieGetter$LWS as DocumentProtoCookieGetter, DocumentProtoCookieSetter$LWS as DocumentProtoCookieSetter, DocumentProtoCreateComment$LWS as DocumentProtoCreateComment, DocumentProtoCreateElement$LWS as DocumentProtoCreateElement, DocumentProtoCreateElementNS$LWS as DocumentProtoCreateElementNS, DocumentProtoDefaultViewGetter$LWS as DocumentProtoDefaultViewGetter, DocumentProtoDocumentElementGetter$LWS as DocumentProtoDocumentElementGetter, DocumentProtoGetElementById$LWS as DocumentProtoGetElementById, DocumentProtoHeadGetter$LWS as DocumentProtoHeadGetter, DocumentProtoImplementationGetter$LWS as DocumentProtoImplementationGetter, DocumentProtoOpen$LWS as DocumentProtoOpen, ElementAriaAttributesToPropertyName$LWS as ElementAriaAttributesToPropertyName, ElementProtoClosest$LWS as ElementProtoClosest, ElementProtoGetAttribute$LWS as ElementProtoGetAttribute, ElementProtoGetAttributeNode$LWS as ElementProtoGetAttributeNode, ElementProtoGetAttributeNodeNS$LWS as ElementProtoGetAttributeNodeNS, ElementProtoHasAttribute$LWS as ElementProtoHasAttribute, ElementProtoInnerHTMLGetter$LWS as ElementProtoInnerHTMLGetter, ElementProtoInnerHTMLSetter$LWS as ElementProtoInnerHTMLSetter, ElementProtoNamespaceURIGetter$LWS as ElementProtoNamespaceURIGetter, ElementProtoOuterHTMLGetter$LWS as ElementProtoOuterHTMLGetter, ElementProtoQuerySelector$LWS as ElementProtoQuerySelector, ElementProtoQuerySelectorAll$LWS as ElementProtoQuerySelectorAll, ElementProtoRemove$LWS as ElementProtoRemove, ElementProtoRemoveAttribute$LWS as ElementProtoRemoveAttribute, ElementProtoRemoveAttributeNS$LWS as ElementProtoRemoveAttributeNS, ElementProtoRemoveAttributeNode$LWS as ElementProtoRemoveAttributeNode, ElementProtoSetAttribute$LWS as ElementProtoSetAttribute, ElementProtoSetAttributeNS$LWS as ElementProtoSetAttributeNS, ElementProtoTagNameGetter$LWS as ElementProtoTagNameGetter, ElementProtoToggleAttribute$LWS as ElementProtoToggleAttribute, ErrorEventCtor$LWS as ErrorEventCtor, EventCtor$LWS as EventCtor, EventProtoCurrentTargetGetter$LWS as EventProtoCurrentTargetGetter, EventProtoStopPropagation$LWS as EventProtoStopPropagation, EventTargetProtoAddEventListener$LWS as EventTargetProtoAddEventListener, EventTargetProtoDispatchEvent$LWS as EventTargetProtoDispatchEvent, EventTargetProtoRemoveEventListener$LWS as EventTargetProtoRemoveEventListener, HTMLAnchorElementProtoHostnameGetter$LWS as HTMLAnchorElementProtoHostnameGetter, HTMLAnchorElementProtoHrefGetter$LWS as HTMLAnchorElementProtoHrefGetter, HTMLAnchorElementProtoHrefSetter$LWS as HTMLAnchorElementProtoHrefSetter, HTMLAnchorElementProtoPathnameGetter$LWS as HTMLAnchorElementProtoPathnameGetter, HTMLAnchorElementProtoProtocolGetter$LWS as HTMLAnchorElementProtoProtocolGetter, HTMLElementGlobalAttributesToPropertyName$LWS as HTMLElementGlobalAttributesToPropertyName, HTMLElementProto$LWS as HTMLElementProto, HTMLElementProtoStyleGetter$LWS as HTMLElementProtoStyleGetter, HTMLIFrameElementProtoContentWindowGetter$LWS as HTMLIFrameElementProtoContentWindowGetter, HTMLIFrameElementProtoSrcSetter$LWS as HTMLIFrameElementProtoSrcSetter, HTMLScriptElementCtor$LWS as HTMLScriptElementCtor, HTMLScriptElementProto$LWS as HTMLScriptElementProto, HTMLScriptElementProtoSrcGetter$LWS as HTMLScriptElementProtoSrcGetter, HTMLScriptElementProtoSrcSetter$LWS as HTMLScriptElementProtoSrcSetter, HTMLTemplateElementProtoContentGetter$LWS as HTMLTemplateElementProtoContentGetter, IS_CHROMIUM_BROWSER$LWS as IS_CHROMIUM_BROWSER, IS_OLD_CHROMIUM_BROWSER$LWS as IS_OLD_CHROMIUM_BROWSER, IS_WEBKIT_BROWSER$LWS as IS_WEBKIT_BROWSER, NAMESPACE_DEFAULT$LWS as NAMESPACE_DEFAULT, NAMESPACE_SVG$LWS as NAMESPACE_SVG, NAMESPACE_XHTML$LWS as NAMESPACE_XHTML, NAMESPACE_XLINK$LWS as NAMESPACE_XLINK, NodeProtoAppendChild$LWS as NodeProtoAppendChild, NodeProtoChildNodesGetter$LWS as NodeProtoChildNodesGetter, NodeProtoCloneNode$LWS as NodeProtoCloneNode, NodeProtoFirstChildGetter$LWS as NodeProtoFirstChildGetter, NodeProtoIsConnectedGetter$LWS as NodeProtoIsConnectedGetter, NodeProtoIsEqualNode$LWS as NodeProtoIsEqualNode, NodeProtoLastChildGetter$LWS as NodeProtoLastChildGetter, NodeProtoNodeNameGetter$LWS as NodeProtoNodeNameGetter, NodeProtoOwnerDocumentGetter$LWS as NodeProtoOwnerDocumentGetter, NodeProtoTextContentGetter$LWS as NodeProtoTextContentGetter, NodeProtoTextContentSetter$LWS as NodeProtoTextContentSetter, RangeProtoCreateContextualFragment$LWS as RangeProtoCreateContextualFragment, RequestProtoURLGetter$LWS as RequestProtoURLGetter, ResponseCtor$LWS as ResponseCtor, ResponseProtoOkGetter$LWS as ResponseProtoOkGetter, ResponseProtoStatus$LWS as ResponseProtoStatus, ResponseProtoStatusText$LWS as ResponseProtoStatusText, ResponseProtoText$LWS as ResponseProtoText, SCRIPT_HOOK_SOURCE_TEXT$LWS as SCRIPT_HOOK_SOURCE_TEXT, SVGScriptElementProtoHrefGetter$LWS as SVGScriptElementProtoHrefGetter, SVGScriptElementProtoHrefSetter$LWS as SVGScriptElementProtoHrefSetter, StorageProtoGetItem$LWS as StorageProtoGetItem, StorageProtoKey$LWS as StorageProtoKey, StorageProtoRemoveItem$LWS as StorageProtoRemoveItem, StorageProtoSetItem$LWS as StorageProtoSetItem, Transpiler$LWS as Transpiler, UNIVERSAL_CONTEXT_NAMES$LWS as UNIVERSAL_CONTEXT_NAMES, URLCreateObjectURL$LWS as URLCreateObjectURL, URLRevokeObjectURL$LWS as URLRevokeObjectURL, WindowClearInterval$LWS as WindowClearInterval, WindowDecodeURIComponent$LWS as WindowDecodeURIComponent, WindowDocumentGetter$LWS as WindowDocumentGetter, WindowEncodeURIComponent$LWS as WindowEncodeURIComponent, WindowFetch$LWS as WindowFetch, WindowFrameElementGetter$LWS as WindowFrameElementGetter, WindowLengthGetter$LWS as WindowLengthGetter, WindowLocationGetter$LWS as WindowLocationGetter, WindowQueueMicrotask$LWS as WindowQueueMicrotask, WindowSetInterval$LWS as WindowSetInterval, XhrCtor$LWS as XhrCtor, XhrProtoAbort$LWS as XhrProtoAbort, XhrProtoOpen$LWS as XhrProtoOpen, XhrProtoResponseTextGetter$LWS as XhrProtoResponseTextGetter, XhrProtoSend$LWS as XhrProtoSend, XhrProtoStatusGetter$LWS as XhrProtoStatusGetter, XhrProtoWithCredentialsSetter$LWS as XhrProtoWithCredentialsSetter, compileSourceText$LWS as compileSourceText, defineScriptAccessorProperty$LWS as defineScriptAccessorProperty, defineScriptEvaluatorProperty$LWS as defineScriptEvaluatorProperty, deleteOriginalScriptProperty$LWS as deleteOriginalScriptProperty, deleteResolvedScriptURL$LWS as deleteResolvedScriptURL, deleteScriptEvaluatorProperty$LWS as deleteScriptEvaluatorProperty, generateContextAssignmentCodeFromContextNames$LWS as generateContextAssignmentCodeFromContextNames, getOriginalScriptProperty$LWS as getOriginalScriptProperty, getResolvedScriptURL$LWS as getResolvedScriptURL, getScriptSrcEvaluatorHookURL$LWS as getScriptSrcEvaluatorHookURL, getValidator$LWS as getValidator, initWindowOpenChildWindow$LWS as initWindowOpenChildWindow, isScriptEvaluated$LWS as isScriptEvaluated, isScriptPropertyEvaluatorHookDefined$LWS as isScriptPropertyEvaluatorHookDefined, isScriptURLEvaluatorHookDefined$LWS as isScriptURLEvaluatorHookDefined, isWindow$LWS as isWindow, markForUnsafePropertyBlocking$LWS as markForUnsafePropertyBlocking, normalizeNamespacedAttributeName$LWS as normalizeNamespacedAttributeName, normalizeWindowOpenArguments$LWS as normalizeWindowOpenArguments, rootDocument$LWS as rootDocument, rootValidator$LWS as rootValidator, rootWindow$LWS as rootWindow, rootWindowLocation$LWS as rootWindowLocation, rootWindowTop$LWS as rootWindowTop, setOriginalScriptScriptProperty$LWS as setOriginalScriptScriptProperty, setResolvedScriptURL$LWS as setResolvedScriptURL, throwIfMarkedAsUnsafeInChildWindow$LWS as throwIfMarkedAsUnsafeInChildWindow, trackScriptAsEvaluated$LWS as trackScriptAsEvaluated, transformSourceText$LWS as transformSourceText };
+/*! version: 0.22.4 */

package.json

 {
     "name": "@locker/shared-dom",
-    "version": "0.22.3",
+    "version": "0.22.4",
     "license": "SEE LICENSE IN LICENSE.txt",
@@ -19,3 +19,3 @@ "author": "Salesforce UI Security Team",
     "dependencies": {
-        "@locker/shared": "0.22.3"
+        "@locker/shared": "0.22.4"
     },
@@ -22,0 +22,0 @@ "files": [

No alert changes

Improved metrics

Total package byte prevSize

177357

increased by5.68%

Lines of code

3047

increased by4.96%

Dependency changes

• + Added@locker/shared@0.22.4(transitive)

• - Removed@locker/shared@0.22.3(transitive)

• Updated@locker/shared@0.22.4